Data Protection Policy

Thank you for your interest in our company. Data protection is of particular importance to the management of InProCoat. You can generally use the websites of InProCoat without indicating any personal data. If a data subject wants to use any special services of our company via our website, however, processing of personal data may become necessary. If processing of personal data is required and if there is no legal basis for such processing, we will generally collect consent of the data subject.

The processing of personal data, e.g. the name, address, email address or phone number of a data subject always takes place in correspondence with the General Data Protection Regulation (GDPR) and in correspondence with the state-specific data protection rules applicable to InProCoat. With this data protection statement, our company wants to inform the public about the type, scope and purpose of the personal data collected, used and processed by us. Furthermore, data subjects will be informed about the rights due to them in this data protection statement.

InProCoat has implemented many technical and organisational measures as the controller for processing in order to ensure the most seamless protection possible concerning the personal data processed via this website. Nevertheless, internet-based data transmissions may generally be subject to safety gaps, so that absolute protection cannot be ensured. For this reason, every data subject is free to transmit personal data to us in alternative ways as well, e.g. by phone.

1. Definitions

The data protection statement of InProCoat is based on the terms used by the European directive and regulation provider when issuing the General Data Protection Regulation. Our data protection statement is to be easily legible and comprehensible, both for the public and for our customers and business partners. In order to ensure this, we would like to explain the terms used in advance.

In this data protection statement we use, among others, the following terms:

a) Personal data

Personal data are any data that refer to an identified or identifiable natural person (hereinafter: "Data Subject"). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

b) Data subject

Data subjects are all identified or identifiable natural persons whose personal data are processed by the controller responsible for processing.

c) Processing

Processing means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

d) Restriction of Processing

Restriction of processing means the marking of stored personal data with the objective of limiting their processing in the future.

e) Profiling

Profiling means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.

f) Pseudonymisation

Pseudonymisation means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.

g) Controller or Controller Responsible for Processing

The controller or controller responsible for processing is the natural or legal person, public authority, institution or other office who decides about the purpose and means of processing of personal data alone or with others. If the purposes and means of this processing are specified by Union or the Member State law, the controller, or the specific criteria of its designation, may be specified according to Union law or the law of the Member States.

h) Processor

The processor is a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

i) Recipient

The recipient is a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not. Public authorities that may receive personal data within the context of a specific inquiry under Union or Member State law are, however, not deemed recipients.

j) Third Party

Third parties are any natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data.

k) Consent

Consent is any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data concerning him or her.

2. Name and address of the controller for processing

The controller within the meaning of the General Data Protection Regulation, other data protection laws applicable in the Member States of the European Union and other provisions with a data-protection character is:

InProCoat Holding GmbH
Industriegebiet Backeswiese 15
D-57223 Kreuztal, Germany

Phone: +49 2732 7931-0
info@inprocoat.com

Website: inprocoat.com

3. Data protection officer

We have appointed a data protection officer for our company.

Dagmar Jung
Helfau 2a
83416 Saaldorf-Surheim
datenschutz(at)inprocoat.com

4. Cookies

The websites of InProCoat use cookies. Cookies are text files that are filed and stored on a computer system via a web browser. Many

websites and servers use cookies. Many cookies contain a cookie ID. A cookie ID is a unique identifier of the cookie. It consists of a string of characters through which websites and servers can be associated with the specific web browser in which the cookie was stored. This enables the visited websites and servers to distinguish the individual browser of the data subject from any other web browser that contains any other cookies. A specific web browser may be recognised and identified by a unique cookie ID.

By use of cookies, InProCoat may provide users of this website with user-friendly services that would be impossible without setting the cookie.

A cookie may optimise the information and offers on our website within the meaning of the user. Cookies enable us, as mentioned before, to recognise the users of our website. The purpose of this recognition is making it easier for users to use our website. For instance, the user of a website that uses cookies does not have to enter his or her access data again every time when he or she visits the website, because this is taken care of by the website and the cookie stored on the user's computer system. Another example is the cookie of a shopping cart in an online shop. The online shop remembers the articles that a customer has placed in the virtual shopping cart using a cookie.

The data subject may prevent setting of cookies by our website at any time by making the corresponding setting in the web browser used and thereby permanently object to setting of cookies. Furthermore, cookies already set may be erased at any time via a web browser or other software programme. This is possible in all common web browsers. If the data subject deactivates setting of cookies in the web browser used, not all functions of our website may be fully usable.

5. Recording of general data and information

The website of InProCoat records a number of general data and information every time the website is called up by a data subject or an automated system. These general data and information are stored in the log files of the server. The recording may include the (1) browser types and versions used, (2) the operating system used by the accessing system, (3) the website from which an accessing system reaches our website (referrer), (4) the sub-websites that are targeted by an accessing system on our website, (5) the date and time of an access to the website, (6) the internet protocol address (IP address), (7) the internet service provider of the accessing system and (8) other similar data and information that serve to defend against danger in case of attacks to our information-technical systems.

When using these general data and information, InProCoat will not draw any conclusions as to the data subject. This information will instead be needed in order to (1) correctly deliver the contents of our website, (2) optimise the contents of our website and advertisements for them, (3) ensure permanent function of our information-technical systems and technology of our website and (4) provide criminal prosecution authorities with the information they need for criminal prosecution in case of a cyberattack. These anonymously collected data and information are therefore evaluated by InProCoat statistically, and with the target of increasing data protection and data security in our company, in order to finally ensure an optimal protection level for the personal data processed by us. The anonymous data of the server log files are stored separately from any other personal data the data subject indicates.

6. Subscription to Our Newsletter

Users can subscribe to our company's newsletter on the website of InProCoat. Which personal data are transmitted to the party responsible for processing when you order a newsletter results from the input screen used for this.

InProCoat will inform its customers and business partners at regular intervals about the company's offers by way of a newsletter. Our company's newsletter can generally only be received by the data subject if (1) the data subject has a valid email address and (2) the data subject registers for newsletter dispatch. For legal reasons, a confirmation email for the double-opt-in procedure is sent to an email address entered for the first time for newsletter dispatch. This confirmation mail serves to check whether the owner of the email address has authorised receipt of the newsletter as a data subject.

When you subscribe to the newsletter, we will also store the internet protocol address assigned by your internet service provider (ISP) at the time of your registration, and the date and time of your registration. Collection of such data is required to track the (possible) abuse of the email address of a data subject at a later time, and therefore serves legal protection of the controller responsible for processing.

The personal data collected within the context of registration for the newsletter will only be used to send out our newsletter. Furthermore, subscribers to the newsletter can be informed by email if this is required for operation of the newsletter service or registration for it. This may be the case if there are any changes to the newsletter offer or the technical situation. The personal data collected in the scope of the newsletter service will not be passed on to any third parties. The subscription to our newsletter can be terminated at any time by the data subject. Consent to storage of personal data once given to us by the data subject for newsletter dispatch may be withdrawn at any time. Every newsletter has a link for the purpose of withdrawing consent. Furthermore, it is also possible to unsubscribe from the newsletter at any time on the website of the controller responsible for processing, or to inform the controller of this otherwise.

7. Newsletter tracking

The newsletter of InProCoat contains counting pixels. A counting pixel is a miniature icon that is embedded in emails sent in HTML format, in order to permit log file recording and log file analysis. This permits statistical evaluation of success or failure of online marketing campaigns. Based on the embedded counting pixel. InProCoat will be able to see whether and when an email was opened by a data subject and which links in the email the data subject called up.

Such personal data collected in the counting pixels contained in the newsletters are stored by the controller for processing and evaluated in order to optimise newsletter dispatch, and to adjust the contents of future newsletters to the interests of the data subject even better in future. These personal data will not be passed on to any third parties. Data subjects have the right, at any time, to withdraw the consent given separately in this respect via the double-opt-in procedure. After withdrawal, such personal data will be deleted by the controller. InProCoat will automatically consider unsubscription from the newsletter to be a revocation.

8. Contact options via the website

The website of InProCoat contains information based on statutory provisions to permit quick electronic contact with our company and direct communication with us, also including a general address for electronic mail (email address). If a data subject contacts the controller for processing by email or through a contact form, the personal data transmitted by this data subject will be stored automatically. Such personal data that the data subject feely transmits to the controller for processing voluntarily are stored for the purpose of processing, or for contacting the data subject. The personal data are not passed on to any third parties.

9. Routine erasure and blocking of personal data

The controller for processing processes and stores personal data of the data subject only for the period that is required to achieve the purpose of storage, or if this was stipulated in laws or provisions that the controller is subject to by the European directive and regulation provider or any other legislator.

If the storage purpose no longer applies, or if any storage period stipulated by the European directive and regulation provider or any other relevant legislator expires, the personal data will be routinely blocked or deleted according to the statutory provisions.

10. Rights of the data subject

a) Right to confirmation

The European directive and regulation provider grants every data subject the right to demand confirmation from the controller of whether any personal data concerning him or her are being processed. If a data subject uses this confirmation right, he or she may contact our data protection officer or another employee of the controller at any time.

b) Right to information

The European directive and regulation provider grants every data subject affected by processing of personal data the right to receive information from the controller free of charge regarding the personal data stored on his or her person and to receive a copy of this information. Furthermore, the European directive and regulation provider grants the data subject the right to be informed about the following:

the purposes of the processing
the categories of personal data that are processed
the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;
if possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning you, or to object to such processing;
the right to lodge a complaint with a supervisory authority;
if the personal data are not obtained from the data subject directly: All available information concerning the origin of the data,
the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

Furthermore, the data subject has the right to be informed on whether personal data have been transmitted to any third country or any international organisation. If this is the case, the data subject further has the right to demand information on the appropriate safeguards in connection with transmission.

If a data subject uses this information right, he or she may contact our data protection officer or another employee of the controller at any time.

c) Right to rectification

The European directive and regulation provider grants every data subject affected by the processing of personal data the right to demand rectification of incorrect personal data concerning him or her without undue delay. Furthermore, the data subject has the right to demand completion of incomplete personal data, under consideration of the purpose of processing — also by way of a supplementary statement.

If a data subject uses this correction right, he or she may contact our data protection officer or another employee of the controller at any time.

d) Right to erasure (right to be forgotten)

The European directive and regulation provider grants every data subject affected by processing of personal data the right to demand that the controller erase the personal data concerning him or her without undue delay, provided that one of the following reasons applies and provided that processing is not required:

The personal data were collected for such purposes or processed in any other manner for which they are no longer required.
The data subject withdraws consent on which the processing is based according to point (a) of Article 6(1) GDPR or point (a) of Article 9(2) GDPR, and where there is no other legal ground for the processing.
The data subject objects to the processing pursuant to Article 21(1) GDPR and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2) GDPR.
The personal data have been unlawfully processed.
The personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject.
The personal data have been collected in relation to the offer of information society services referred to in Article 8(1) GDPR.

If one of the above reasons applies and a data subject wants to initiate erasure of personal data stored by InProCoat, he or she may contact an employee of the controller for this at any time. The data protection officer of InProCoat or another employee will have the erasure request processed without undue delay.

If the personal data were published by InProCoat, and if our company is required to erase the personal data as controller in accordance with sect. 17 para. 1 GDPR, InProCoat will take appropriate measures, under consideration of the available technology and implementation costs, including measures of technical nature, in order to inform any other controllers of processing activities that process the published personal data of the fact that the data subject has demanded erasure of all links to such personal data or copies or replications of these personal data from other controllers for processing activities as far as processing is no longer required. The data protection officer of InProCoat or another employee will initiate all necessary steps from case to case.

e) Right to restriction of Processing

The European directive and regulation provider grants every data subject affected by processing of personal data the right to demand that the controller restrict processing if one of the following conditions is met:

The accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data.
The processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead.
The controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims.
The data subject has objected to processing pursuant to Article 21(1) GDPR pending the verification whether the legitimate grounds of the controller override those of the data subject.

If one of the above reasons applies and a data subject wants to demand restriction of personal data stored by InProCoat, he or she may contact an employee of the controller for this at any time. The data protection officer of InProCoat or another employee will initiate restriction of processing.

f) Right to data portability

The European directive and regulation provider grants every data subject affected by processing of personal data the right to receive the personal data concerning him or her that have been provided to a controller by the data subject in a structured, common and machine-readable format. He or she shall further have the right to transmit the data to another controller without impairment by the controller by whom the personal data have been processed, provided that processing was based on consent in accordance with point (a) of Article 6(1) GDPR or point (a) of Article 9(2) GDPR or a contract in accordance with point (b) of Article 6(1) GDPR and processing takes place using automated procedures, provided that processing is not required to perform a task that is in the public interest or to exercise public power that has been assigned to the controller.

Furthermore, the data subject has the right, in the scope of his or her right to data portability in accordance with Article 20(1) GDPR, to demand that the personal data be directly transmitted to another controller as far as this is technically feasible and does not impair the rights and freedoms of another person.

In order to assert the right to data portability, the data subject may contact a data protection officer appointed by InProCoat or another employee at any time.

g) Right to object

The European directive and regulation provider grants every data subject affected by processing of personal data the right to object to processing of the personal data concerning him or her that takes place based on point (e) or (f) of Article 6(1) GDPR at any time, based on reasons resulting from his or her special situation. This shall also apply to profiling based on this provision.

InProCoat shall no longer process the personal data in case of objection, unless we demonstrate compelling legitimate grounds for processing that override the interests, rights and freedoms of the data subject or if processing serves the establishment, exercise or defence of legal claims.

If InProCoat processes personal data for direct marketing purposes, the data subject shall have the right to object to processing of the personal data for the purpose of such marketing at any time. This shall also apply to profiling as far as this is connected to such direct marketing. If the data subject objects to processing for direct marketing purposes towards InProCoat, InProCoat shall no longer process the personal data for such purposes.

Where personal data are processed by InProCoat for scientific or historical research purposes or statistical purposes in accordance with Article 89(1) GDPR, the data subject shall also have the right, on grounds relating to his or her particular situation, to object to processing of personal data concerning him or her, unless such processing is necessary for performance of a task carried out for reasons of public interest.

In order to exercise the right to object, the data subject may contact the data protection officer of InProCoat or another employee directly at any time. The data subject shall further be free to exercise the right to object in connection with use of services of the information society, no matter directive 2002/58/EC, where technical specifications are used.

h) Automated individual decision-making, including profiling

The European directive and regulation provider grants every data subject affected by processing of personal data the right to not be subject to a decision based on automated processing — including profiling — that has any legal effect towards him or her or that similarly considerably impairs him or her, provided that the decision (1) is not required for conclusion or performance of a contract between the data subject and the controller, or (2) is permitted based on the legal provisions of the Union or Member States the controller is subject to and these legal provisions contain appropriate measures to preserve the rights and freedoms and the legitimate interests of the data subject, or (3) takes place with the express consent of the data subject.

If the decision (1) is required to conclude or perform a contract between the data subject and the controller, or (2) if it takes place with the explicit consent of the data subject, InProCoat shall implement appropriate measures to safeguard the data subject's rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision.

If the data subject wants to assert rights with a reference to automated decisions, he or she may contact our data protection officer or another employee of the controller at any time.

10. SalesViewer Technology compliance:

We have implemented SalesViewer® technology, owned by SalesViewer®, to gather and store data for research, marketing and optimization purposes.

This data allows creating user profiles under fictitious names. Tracking scripts are being applied to help generate simple company information. This information can neither be used to personally identify a visitor of the website without his/her explicit permission, nor can personal information be associated with his/her fictitious name.

Generating and storing information can be denied at any time in the future by simply logging in to www.salesviewer.com/opt-out . This way an opt-out-cookie for this particular website will be implemented on your device. In case you are deleting cookies in this browser you must click the above link again.

Our social media appearances

This privacy policy applies to the following social media presence

Data processing through social networks

We maintain publicly available profiles in social networks. The individual social networks we use can be found below.

Social networks such as Facebook, X etc. can generally analyze your user behavior comprehensively if you visit their website or a website with integrated social media content (e.g., like buttons or banner ads). When you visit our social media pages, numerous data protection-relevant processing operations are triggered. In detail:

If you are logged in to your social media account and visit our social media page, the operator of the social media portal can assign this visit to your user account. Under certain circumstances, your personal data may also be recorded if you are not logged in or do not have an account with the respective social media portal. In this case, this data is collected, for example, via cookies stored on your device or by recording your IP address.

Using the data collected in this way, the operators of the social media portals can create user profiles in which their preferences and interests are stored. This way you can see interest-based advertising inside and outside of your social media presence. If you have an account with the social network, interest-based advertising can be displayed on any device you are logged in to or have logged in to.

Please also note that we cannot retrace all processing operations on the social media portals. Depending on the provider, additional processing operations may therefore be carried out by the operators of the social media portals. Details can be found in the terms of use and privacy policy of the respective social media portals.

Legal basis

Our social media appearances should ensure the widest possible presence on the Internet. This is a legitimate interest within the meaning of Art. 6 (1) lit. f GDPR. The analysis processes initiated by the social networks may be based on divergent legal bases to be specified by the operators of the social networks (e.g., consent within the meaning of Art. 6 (1) (a) GDPR).

Responsibility and assertion of rights

If you visit one of our social media sites (e.g., Facebook), we, together with the operator of the social media platform, are responsible for the data processing operations triggered during this visit. You can in principle protect your rights (information, correction, deletion, limitation of processing, data portability and complaint) vis-à-vis us as well as vis-à-vis the operator of the respective social media portal (e.g., Facebook).

Please note that despite the shared responsibility with the social media portal operators, we do not have full influence on the data processing operations of the social media portals. Our options are determined by the company policy of the respective provider.

Storage time

The data collected directly from us via the social media presence will be deleted from our systems as soon as you ask us to delete it, you revoke your consent to the storage or the purpose for the data storage lapses. Stored cookies remain on your device until you delete them. Mandatory statutory provisions - in particular, retention periods - remain unaffected.

We have no control over the storage duration of your data that are stored by the social network operators for their own purposes. For details, please contact the social network operators directly (e.g., in their privacy policy, see below).

Your rights

You have the right to receive information about the origin, recipient and purpose of your stored personal data at any time and free of charge. You also have the right to object, the right to data portability and the right to file a complaint with the responsible regulatory agency. Furthermore, you can request the correction, blocking, deletion and, under certain circumstances, the restriction of the processing of your personal data.

Individual social networks

Facebook

We have a profile on Facebook. The provider of this service is Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (hereinafter Meta). According to Meta’s statement the collected data will also be transferred to the USA and to other third-party countries.

We have signed an agreement with Meta on shared responsibility for the processing of data (Controller Addendum). This agreement determines which data processing operations we or Meta are responsible for when you visit our Facebook Fanpage. This agreement can be viewed at the following link: https://www.facebook.com/legal/terms/page_controller_addendum.

You can customize your advertising settings independently in your user account. Click on the following link and log in:https://www.facebook.com/settings?tab=ads.

Data transmission to the US is based on the Standard Contractual Clauses (SCC) of the European Commission. Details can be found here: https://www.facebook.com/legal/EU_data_transfer_addendum and https://de-de.facebook.com/help/566994660333381.

Details can be found in the Facebook privacy policy: https://www.facebook.com/about/privacy/.

The company is certified in accordance with the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the US, which is intended to ensure compliance with European data protection standards for data processing in the US. Every company certified under the DPF is obliged to comply with these data protection standards. For more information, please contact the provider under the following link: https://www.dataprivacyframework.gov/s/participant-search/participant-detail?contact=true&id=a2zt0000000GnywAAC&status=Active

Instagram

We have a profile on Instagram. The provider of this service is Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

Data transmission to the US is based on the Standard Contractual Clauses (SCC) of the European Commission. Details can be found here: https://www.facebook.com/legal/EU_data_transfer_addendum, https://privacycenter.instagram.com/policy/ and https://de-de.facebook.com/help/566994660333381.

For details on how they handle your personal information, see the Instagram Privacy Policy: https://privacycenter.instagram.com/policy/.

We have a LinkedIn profile. The provider is the LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. LinkedIn uses advertising cookies.

If you want to disable LinkedIn advertising cookies, please use the following link: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.

Data transmission to the US is based on the Standard Contractual Clauses (SCC) of the European Commission. Details can be found here: https://www.linkedin.com/legal/l/dpa and https://www.linkedin.com/legal/l/eu-sccs.

For details on how they handle your personal information, please refer to LinkedIn's privacy policy: https://www.linkedin.com/legal/privacy-policy.